Outbound email infrastructure and deliverability
Domain setup, warmup, volume caps and complaint thresholds for SaaS outbound after the bulk sender rules, plus how to tell deliverability from bad targeting.
On this page 9 sections
- What the bulk sender requirements actually demand
- How to build a sending domain and inbox structure that survives
- Warmup timelines and the daily caps that hold up in 2026
- List hygiene is where complaint rate is actually decided
- The diagnostic that separates deliverability from targeting
- Why fixing infrastructure to deliver a bad message is the expensive mistake
- When to stop sending entirely
- What the infrastructure actually costs
- What to do in the next two weeks
- Frequently asked questions
The short answer
Outbound email deliverability for SaaS rests on four things. Authenticate every sending domain with SPF, DKIM and DMARC. Send cold volume from secondary domains, never your primary one, at 25 to 40 messages per inbox per day after a three to four week warmup. Verify lists and keep hard bounces under 2 percent. Hold spam complaints under 0.3 percent in Google Postmaster Tools, the threshold Gmail and Yahoo have enforced since February 2024.
Key points before you start
A cold outbound program has two halves that fail independently. One is the list and the message. The other is the plumbing that decides whether the message arrives at all, and since February 2024 that plumbing has been governed by published rules the big mailbox providers enforce automatically. Most teams meet those rules for the first time after a domain is already cooked.
This page is the plumbing half. The strategy half lives in the B2B SaaS Outbound Marketing Playbook, and it matters more. Infrastructure only decides whether a good message gets a chance.
What the bulk sender requirements actually demand
Send more than 5,000 messages in a day to Gmail addresses and you are a bulk sender. That status brings five obligations: SPF and DKIM records on the sending domain, a DMARC policy of at least p equals none, alignment between the visible From domain and one of the authenticating domains, an RFC 8058 one-click unsubscribe header with unsubscribes processed inside two days, and a spam complaint rate held under 0.3 percent as measured in Google Postmaster Tools.
Yahoo published the same package on the same February 2024 timeline. Microsoft followed with its own version for Outlook.com, Hotmail and Live addresses from 5 May 2025, beginning with junk folder routing for non-compliant senders and tightening toward rejection after that.
| Requirement | Applies to | What breaks without it |
|---|---|---|
| SPF or DKIM | Every sender, any volume | Messages fail basic auth checks and get filtered |
| SPF and DKIM both | Bulk senders over 5,000 a day to Gmail | Rejection at the gateway for new sending domains |
| DMARC at p equals none | Bulk senders | Gmail and Yahoo refuse bulk volume outright |
| From domain alignment | Bulk senders | Auth passes technically but fails alignment, same result |
| One-click unsubscribe header | Bulk senders | Recipients use the spam button instead, which is worse |
| Valid forward and reverse DNS | Every sender | Sending IP looks unattributable, heavy filtering |
| Complaint rate under 0.3 percent | Every sender | Progressive filtering, then domain level blocking |
The threshold is a floor, not a licence. The 0.3 percent complaint rule applies to everyone regardless of volume, and a 40-inbox cold setup that never crosses 5,000 a day to a single provider is still judged on it.
0.3%
Spam complaint rate at which Gmail starts filtering a sender, with 0.1 percent the practical working limit
Google Email Sender Guidelines
Here is the part nobody says out loud. Authentication is a weekend of DNS work and then it is done forever. Complaint rate is the hard requirement, it is decided entirely by who you send to and what you say, and no amount of infrastructure work moves it.
How to build a sending domain and inbox structure that survives
Never send cold volume from the domain your product runs on. Buy secondary domains that read as yours, redirect them at your main site, and keep your primary domain for transactional mail, product notifications and lifecycle email.
The reason is operational rather than theoretical. If a cold campaign damages your primary domain’s sender reputation, password reset emails stop arriving. That is a support incident, an on-call page and an angry customer thread, all caused by a marketing decision.
The single most expensive setup error
Running cold sequences through the same Google Workspace domain that sends your invoices and product alerts. It works for about six weeks. Then a bad list lands, complaints spike, and your transactional mail starts going to junk for every customer you have.
Structure follows simple arithmetic. Two to three mailboxes per secondary domain, 25 to 40 sends per mailbox per working day, five working days a week.
Building an outbound sending stack from scratch
- Buy the domains early
Register two to four lookalike domains and 301 redirect them to your main site. Registration date matters to filters, so buy them at least two weeks before the first send. Around 12 dollars each per year.
- Create two or three mailboxes on each
Real names of real people on your team, with full signatures and profile photos. Google Workspace runs roughly 7 to 14 dollars per mailbox per month, Microsoft 365 Business Basic around 6. You are done when each inbox can send and receive normally from a phone.
- Publish SPF, DKIM and DMARC on every sending domain
One SPF record listing only the services that actually send, DKIM keys from the provider, and a DMARC record starting at p equals none with an rua address you monitor. Verify with any public DMARC lookup before sending anything.
- Turn on custom tracking domains
Point a subdomain of the sending domain at your sequencer for link tracking. Shared tracking domains carry other senders' reputation, and that is the one shared resource you cannot audit.
- Warm each inbox for three to four weeks
Ramp from five a day to your target cap. You know it worked when seed tests land in the primary inbox on both Gmail and Outlook at full volume.
- Turn image tracking off and keep plain text
No HTML template, no logo, no tracked open pixel if you can avoid it. A message that looks like a person wrote it in Gmail is filtered less and read more.
- Register every domain in Google Postmaster Tools and Microsoft SNDS
Free, takes ten minutes, and it is the only place complaint rate is visible. Do this before you have a problem, because the data is not retroactive.
To sustain 2,000 cold sends a week, you need 16 warmed mailboxes across five or six domains at 25 a day. That number surprises people who budgeted for one inbox and a sequencing tool. It is also why list quality matters so much: you cannot cheaply buy your way past a bad list with more volume.
Editable working copy
Get this checklist as a working file
Save the checks on this page as a working copy and assign an owner, status and evidence for each action.
Warmup timelines and the daily caps that hold up in 2026
Warmup is four weeks of deliberately sending too little. The goal is a sending pattern that looks like a working professional rather than a machine, with replies arriving and messages being read, filed and starred.
| Week | Sends per inbox per day | What you are watching |
|---|---|---|
| Pre-send | 0 | Domain age past 14 days, DNS records verified |
| Week 1 | 5 to 10 | Manual replies, no bounces, no spam placement on seeds |
| Week 2 | 15 to 20 | Reply rate holding, Postmaster showing no complaints |
| Week 3 | 25 to 30 | Seed tests still landing in primary inbox |
| Week 4 | 30 to 40 | Stable placement at target cap |
| Steady state | 25 to 40 | Complaint rate under 0.1 percent, bounces under 2 percent |
Automated warmup pools inside tools like Instantly and Smartlead send reciprocal mail between member accounts to generate positive engagement. They help, and they carry a cost people rarely mention. Warmup traffic is counted by your own reporting and by Postmaster Tools, so your engagement metrics become a blend of real prospects and bot accounts that always open and always reply. Your dashboard looks healthy while your actual campaigns are being filtered.
If you run warmup pools, pause them for 48 hours before you take any reading you plan to act on. Otherwise you are measuring the warmup network.
List hygiene is where complaint rate is actually decided
Verification and suppression do more for deliverability than any DNS change. A verified list protects the bounce rate, and a disciplined suppression list protects the complaint rate.
Run every list through a verifier before it enters a sequence. ZeroBounce, NeverBounce and MillionVerifier all price around half a cent to one cent per address, so verifying 4,000 contacts a month costs between 20 and 40 dollars. That is the cheapest insurance in the entire program.
Then apply suppression rules that most teams only write after being burned:
- Anyone who replied negatively or unsubscribed, forever, across every sequence and every domain
- Current customers, open opportunities and anyone with a live support ticket
- Role accounts such as info, sales, support, admin and billing, which complain at far higher rates and tell you nothing about a buyer
- Contacts sourced more than 90 days ago without re-verification, since B2B contact data decays somewhere around 25 to 30 percent a year on the ranges data vendors typically quote
- Catch-all domains, or at least a separate low-volume lane for them, because verifiers cannot confirm those addresses and they usually represent 15 to 25 percent of a B2B list
Catch-all domains are the quiet killer
A verifier returns accept-all rather than valid for these, and teams often treat that as good enough. Send 500 of them into a normal sequence and you can take a clean 1 percent bounce rate to 6 percent overnight. Put them in their own campaign at low volume and judge them on their own numbers.
One more rule that is unpopular and correct. If you cannot write the sentence explaining why this specific person would want this specific message, they do not belong on the list. That sentence is the whole difference between a 0.05 percent complaint rate and a 0.4 percent one. The outbound lead generation guide covers how to build a list that passes that test.
The diagnostic that separates deliverability from targeting
Most teams misdiagnose this, and the misdiagnosis is always in the same direction. Poor results get blamed on the inbox because infrastructure feels fixable and the message does not. Run the diagnostic before you rebuild anything.
| What you observe | Most likely cause | First thing to check | Do not do this |
|---|---|---|---|
| Bounce rate above 5 percent | List quality or stale data | Re-verify the batch and check the source | Buy more domains |
| Bounces under 2 percent, replies near zero, seeds land in spam | Placement problem, genuine | Domain reputation in Postmaster, blacklist check, DMARC alignment | Rewrite the copy again |
| Bounces under 2 percent, seeds land in inbox, replies near zero | Targeting or offer | Read 50 messages aloud and ask who would answer | Add more inboxes |
| Replies arrive but are all negative or confused | Wrong segment entirely | Compare reply sentiment by persona and company size | Increase send volume |
| Every inbox on one domain drops at once | Domain level reputation event | Postmaster reputation chart, Spamhaus and SURBL lookups | Keep sending to see if it recovers |
| One inbox drops, others on the same domain are fine | That mailbox's sending pattern or a spam trap hit | Pause it, check its specific list segment | Blame the domain |
Seed testing is the fast version. Create real mailboxes on Gmail, Outlook.com and a Microsoft 365 tenant, put them in a live campaign, and look at where the message lands. Tools like GlockApps and MailReach do this at scale. Fifteen minutes of seed testing settles the argument that otherwise runs for a month.
There is one measurement trap worth naming. Google Postmaster Tools only populates its reputation and spam rate charts once a domain sends meaningful daily volume to Gmail, and a cold setup that splits 2,000 weekly sends across six domains may never reach that volume on any single domain. The many-domains pattern that protects your reputation also removes your ability to see it. Accept the tradeoff knowingly, and lean harder on bounce rate, reply rate and seed placement as your instruments.
What normal looks like
For a well targeted B2B SaaS cold sequence in 2026, expect a 1 to 3 percent positive reply rate, a 4 to 10 percent total reply rate including negatives and out of office, bounces under 2 percent, and complaints under 0.1 percent. A positive reply rate under 0.5 percent on clean placement is a message and list problem every time.
Why fixing infrastructure to deliver a bad message is the expensive mistake
Most teams blame deliverability for what is an irrelevant list. The tell is a team that has rebuilt its sending stack twice and rewritten its ICP zero times.
Consider the arithmetic. A team sending 2,000 messages a week at a 0.3 percent positive reply rate gets six conversations. Doubling deliverability from 60 percent inbox placement to 90 percent turns six into nine. Fixing targeting so the positive reply rate hits 2 percent turns six into forty, on the same infrastructure, with no new domains.
The second fix is harder, slower and unglamorous. It means narrowing the list, throwing away 70 percent of the accounts someone already paid to enrich, and writing a message that only makes sense to one narrow segment. Nobody gets to announce that in a standup. So teams buy more inboxes.
We spent a quarter on sending infrastructure and got our placement from decent to excellent. Reply rate moved from 0.4 to 0.5 percent. Then we cut the list from 12,000 accounts to 900 and reply rate went to 3 percent in two weeks.
That composite reflects a pattern we see repeatedly. It is also why outbound demand generation should start from segment selection and work down to plumbing, never the reverse. If you want examples of messages that earn replies rather than complaints, the cold email teardowns break down live sequences line by line.
Editable CSV worksheet
SaaS benchmark evaluation worksheet
Record the source, date, cohort and metric definition before comparing your numbers with a benchmark.
When to stop sending entirely
Some numbers mean pause today, not optimise next sprint. Treat these as hard stops rather than warnings.
Hard stop criteria for an outbound sending program
0 of 6 done
Recovery on a damaged domain takes four to six weeks of rest and a fresh warmup, and it is often not worth it. Domains cost about 12 dollars. Mailboxes cost a few dollars a month. Retiring a burned domain and standing up a clean one is usually faster and cheaper than nursing a bad reputation back, provided you have fixed the behaviour that caused it. If you have not, the new domain burns too.
There is also a strategic version of stopping. If your ACV is under roughly 8,000 dollars and your cycle is short, outbound economics rarely clear. The fully loaded cost of an SDR runs 6,000 to 9,000 dollars a month against a few hundred in infrastructure, and at low ACV the maths stops working long before deliverability does. The inbound versus outbound comparison works through where the crossover sits, and a free tool as a lead source often beats cold email at that price point.
What the infrastructure actually costs
Here is the real monthly bill for a program sending 2,000 cold messages a week, which is roughly two SDRs’ worth of volume.
| Line item | Monthly cost | Notes |
|---|---|---|
| Six secondary domains | About 6 dollars | Roughly 12 dollars a year each |
| Sixteen mailboxes | 100 to 220 dollars | Google Workspace or Microsoft 365 Business Basic |
| Sequencing platform | 100 to 300 dollars | Instantly or Smartlead tier, or per seat on Outreach and Salesloft |
| List verification | 20 to 60 dollars | 4,000 to 8,000 verifications a month |
| Warmup and placement monitoring | 30 to 100 dollars | Optional, and see the caveat above |
| Total infrastructure | 260 to 690 dollars | |
| Two SDRs, fully loaded | 12,000 to 18,000 dollars | Salary, commission, tooling, management |
Infrastructure is roughly 4 to 6 percent of program cost. The people and the data are the other 94 percent. Any hour spent tuning DKIM selectors that could have been spent narrowing the account list is a bad trade, and the ratio above explains why. This also shapes how you count results downstream, since a reply is not yet an MQL and treating it as one inflates every number above it.
The one infrastructure investment that always pays
Verification. At half a cent per address it is the only line item that directly protects the two metrics that get domains blocked, and it is the only place where spending more money reliably produces a better number.
What to do in the next two weeks
Start with the diagnostic, not the rebuild. Put three seed mailboxes into your live sequence today and find out where your messages land. If they land in the inbox, you have a targeting problem and no amount of DNS work will fix it.
If placement is genuinely broken, work the order that matters: verify the list, publish SPF, DKIM and DMARC on every sending domain, move cold volume off your primary domain, and rebuild warmup from week one rather than resuming at your old cap. Register every domain in Postmaster Tools while you do it so the next incident has data behind it.
Then go back to the part that decides the outcome. Narrow the segment until you can write the sentence explaining why this person wants this message, and hold the list to that standard. Everything in this guide is what makes a good message arrive. The rest of SaaS lead generation is what makes it worth arriving.
Editable CSV worksheet
SaaS Lead Generation planning worksheet
A practical lead gen planning worksheet: decisions, owners, evidence and next actions.
Frequently asked questions
How many cold emails can you send per inbox per day in 2026?
Between 25 and 40 after a full warmup is the range most SaaS teams settle on. Some tools claim 50 or more is safe. It can be, on an aged domain with a clean list and strong reply rates, but the risk is asymmetric. A burned domain costs four to six weeks of rebuild time and a few dollars of savings never covers that.
What are the Google and Yahoo bulk sender requirements?
Senders of more than 5,000 messages a day to Gmail addresses must publish SPF and DKIM records, publish a DMARC policy of at least p equals none, align the visible From domain with SPF or DKIM, include an RFC 8058 one-click unsubscribe header, honour unsubscribes within two days, and keep spam complaint rates below 0.3 percent. Yahoo published matching rules on the same February 2024 timeline.
Should cold email come from your main company domain?
No. Use secondary domains that resolve to your brand, such as a get or try prefix on your company name, and point them at your main site. Your primary domain carries transactional email, product notifications, invoices and password resets. One bad cold campaign that tanks that domain's reputation means customers stop receiving password resets, which is a support incident rather than a marketing problem.
Is a 0.3 percent spam complaint rate hard to hit?
Three complaints per thousand delivered messages sounds generous and is not. At 2,000 sends a week, six people marking you as spam puts you at the ceiling. Cold lists reach it quickly when targeting is loose, because a recipient who has no plausible reason to hear from you reports rather than deletes. Track it weekly in Google Postmaster Tools and treat 0.1 percent as the real working limit.
How do you tell a deliverability problem from a bad list?
Run a seed placement test. If your messages land in inbox on Gmail and Outlook seed accounts and your bounce rate is under 2 percent, delivery is working and the problem is the list or the message. If seeds land in spam or go missing, you have a placement problem. Doing this before rebuilding infrastructure saves most teams a wasted month.
How long does cold email domain warmup take?
Three to four weeks to reach steady state. Week one sits at five to ten sends a day per inbox, week two at fifteen to twenty, week three at twenty five to thirty, and week four moves to the cap you intend to hold. Domains also need at least two weeks of age before the first send, so budget five to six weeks from domain purchase to production volume.
Can you still measure open rates for outbound email?
Not reliably. Apple Mail Privacy Protection preloads tracking pixels through a proxy, so an open fires whether or not a human looked, and Apple Mail handles a large share of B2B recipients. Open rate is now useful only as a relative comparison between two campaigns sent to similar lists in the same week. Reply rate and bounce rate carry the real information.
The saas-marketing.net editorial team Research and editorial
We research, write and maintain every page on this site. The library explains marketing decisions through practical frameworks, explicit assumptions and references. Corrections can be requested through the contact page.
Published September 11, 2026. Last updated .